Real data in.
A synthetic twin
you can share
The Convert step of the privacy-aware pipeline. Replace real records with synthetic replicas that keep the shape and the statistics but none of the identities — deterministic for a given seed, ephemeral by default.
Same shape. A new identity.
A real record goes in; a synthetic replica comes out. Identifying fields are regenerated into plausible fakes; the structural fields that downstream code depends on are kept. It reads as real, and points to no one.
Deterministic for a seed — the same input and seed always produce the same twin, so fixtures are reproducible and outputs are diffable.
Five properties a synthetic twin needs.
Synthetic data is only useful if it behaves like the real thing and leaks none of it. These are the properties that make a replica safe to share and trustworthy to build on.
Ephemeral by default
Source content and generated replicas never persist beyond the call boundary. Nothing is written to disk unless you explicitly opt in — the safe default is that the real data was only ever in memory, for one call.
Deterministic for a seed
Same input + same seed + same policy produces the same replica, every time. Reproducible fixtures, diffable outputs, and tests that don't flake — synthesis you can pin.
Shape in, shape out
The replica keeps the schema, the types, the format, and the statistical distribution of the source — so the code and models downstream of it behave exactly as they would on the real thing.
No real identity survives
Every name, identifier, and sensitive value is regenerated. The output looks real and reads real — but corresponds to no real person or record, so it's free to share, store, and screenshot.
Model calls stay governed
Any LLM used for synthesis goes through ogentic_llm — retries, cost tracking, and observability — never a raw provider SDK. And errors are sanitized: callers never see raw model output on a failure path.
Convert is the fourth step of the pipeline: Shield classifies, Redact masks, Router routes — and Convert makes a shareable synthetic twin when you need the data itself to travel.
A new record with the same shape.
Not a mask over the old record — a freshly generated one. Same schema, same field types, same distribution, plausible values throughout. Because it's synthetic, it's safe to keep, share, and ship.
- Seed
- a value you pass — pins the output
- Determinism
- input + seed + policy → same replica
- Persistence
- ephemeral by default (opt-in to keep)
- Preserves
- schema · types · format · distribution
- Replaces
- every identifying value
- Errors
- sanitized; never raw model output
Same input, same seed, same replica — every time. Reproducibility is a first-class property, so fixtures are stable and outputs are diffable.
When the data itself has to travel.
Redaction is enough when the model just needs to read the text. Convert is for when you need the data to leave the building — into a test suite, a demo, a training set, or a partner's hands.
Realistic fixtures, zero real people
Generate synthetic records that exercise the same code paths as production data — same shapes, same edge cases — without a single real identity in your test suite or CI logs.
Screens you can actually show
Populate a demo, a screenshot, or a sales environment with data that looks real and holds together — because it corresponds to no real customer, it's safe to share anywhere.
Model work without the PII
Build training and evaluation sets that preserve the statistics of the real corpus while carrying none of the identities — useful signal, nothing to leak.
Hand a dataset to a vendor
Send a partner or a vendor a faithful synthetic replica of your data instead of the real thing — the schema they need to build against, without the exposure.
Read, model, synthesize — keep nothing.
Five steps from a real record to a synthetic one. The source lives in memory only for the length of the call; the replica is deterministic for the seed, and nothing persists unless you ask it to.
readParse the source
The real record is read into memory and its schema, types, and format are captured. It lives here only for the length of the call.
modelLearn the shape
The structure and statistical distribution of the source are modeled — what a field looks like, how values are shaped, what has to stay internally consistent.
convert()Generate the replica
From the seed, a new record is synthesized that matches the shape — plausible, self-consistent, and identity-free. Same seed, same replica.
conformCheck it fits
The replica is validated against the source schema and the target policy — it has to be a drop-in for the real thing downstream.
returnHand it back, keep nothing
The replica is returned; the source is dropped. Nothing persists beyond the call boundary unless you asked it to.
read → model → convert() → conform → return// Ephemeral by default — the source and the replica never persist beyond the call boundary unless you explicitly opt in.
Keep the shape. Replace the identity.
The line the converter draws is simple: everything downstream code and models depend on is preserved; everything that could point back to a real person is regenerated.
Kept
Everything downstream code depends on stays intact — so the replica is a true drop-in for the real record.
- schema · field types
- format · length
- statistical distribution
Replaced
Every value that could point back to a real person or record is regenerated into a plausible, fabricated stand-in.
- names · emails · ids
- account / card numbers
- free-text with PII
Controlled
You control reproducibility and lifetime — a seed pins the output, and nothing is kept unless you opt in.
- seed → determinism
- ephemeral by default
- policy-bounded
Redact masks it. Convert replaces it.
Redaction turns sensitive values into reversible tokens for a round-trip through a model. Conversion generates a whole new record — no tokens, no vault, nothing to reverse, because there's no real data left in it.
- Output
- Tokens ([RTKN_…])
- Reversible
- Yes — via the vault
- Reads as real
- No (placeholders)
- Free to share
- Only with the vault kept apart
- Best for
- Send to an LLM, restore after
- Output
- A whole synthetic record
- Reversible
- No — it's new data
- Reads as real
- Yes (plausible values)
- Free to share
- Yes — no real identity
- Best for
- Test data, demos, training
They're complementary. Reach for ogentic-redact ↗ when a model needs to read the text and you want the originals back afterward. Reach for Convert when the data has to leave — as a synthetic twin that reads real and belongs to no one.
Convert a record in one call.
Python 3.11+, Pydantic-typed, Apache-2.0. The examples below are illustrative — the public API is being finalized ahead of the first release.
from ogentic_converter import Converter conv = Converter() replica = conv.convert(record, seed="run-42") # same schema, synthetic values — deterministic for this seed. # the source and the replica are ephemeral: nothing is written # to disk unless you explicitly opt in.
a = Converter().convert(record, seed="run-42") b = Converter().convert(record, seed="run-42") assert a == b # input + seed + policy -> the same replica c = Converter().convert(record, seed="run-43") assert c != a # a different seed -> a different twin
pip install ogentic-converter # coming soon # Python 3.11+, Apache-2.0. Follow the repo for the first release.
The fourth verb: classify, redact, route — convert.
Composable Apache-2.0 primitives for regulated AI. Shield reads sensitivity, Redact masks it, Router routes it, Audit proves it — and Convert makes a shareable synthetic twin when the data itself has to move. Four are live; Convert is next.
classify → redact → route → convert · Convert is the synthesis step alongside ogentic-shield ↗, ogentic-redact ↗, and ogentic-router ↗ — part of the OgenticAI ↗ OSS suite.
Convert is on the way.
The synthesis primitive of the OgenticAI suite — deterministic, ephemeral, Apache-2.0. Follow the repository for the first release, and use the rest of the pipeline today.